What is CGNAT?
CGNAT (Carrier-Grade NAT) lets ISPs share public IPv4 addresses across many subscribers. We explain how it works, the drawbacks and the link to IPv6.
Last updated:
CGNAT (Carrier-Grade NAT, also called Large-Scale NAT) is address translation performed at scale on the operator's side. It lets many subscribers share a single public IPv4 address. The IPv4 pool is exhausted, so operators cannot give every customer their own public address. Instead they add an extra NAT layer inside their network and serve thousands of users with private addresses behind a handful of public ones.
How CGNAT works
A typical deployment has two layers of translation. The subscriber's router does NAT from the home network to an address from the operator's pool, and the CGNAT device translates that address into a shared public address. A special range, 100.64.0.0/10 (RFC 6598), is reserved for addressing between these layers so it does not clash with private addresses in the customer's home network. CGNAT assigns each session a port from a shared pool, so the number of simultaneous connections per public address is limited.
Drawbacks and limitations of CGNAT
- No inbound traffic: a subscriber behind CGNAT has no public IP of their own, so port forwarding and self-hosting are hard.
- Port exhaustion: many active sessions per address can cause connection errors under heavy load.
- Geolocation and reputation: a shared address may be mislocated, and one user's actions can affect others (CAPTCHAs, blocks).
- Gaming, P2P and VoIP: apps that need direct connections or a stable address work worse.
- Logging: the operator must record port mappings, which raises legal and hardware requirements.
CGNAT versus IPv6
CGNAT is a temporary measure that mitigates the IPv4 shortage, not an end state. The real solution is deploying IPv6. It provides a practically unlimited address pool and restores end-to-end connectivity without translation. In practice operators run dual-stack: IPv6 traffic bypasses CGNAT and offloads the translation devices, so CGNAT only handles the shrinking IPv4 traffic. The higher the IPv6 adoption, the lower the dependence on CGNAT and its limitations.
CGNAT, IPv6 and AS202520 SkyPass
AS202520 SkyPass delivers connectivity and IP transit in full dual-stack, with native IPv4 and IPv6. For operators that want to reduce their dependence on CGNAT, we help maximize IPv6 use and keep clean, well-routed IPv4 addressing where it is still needed. That helps push back the cost and limitations of large-scale translation.
Frequently asked questions
Why do operators use CGNAT?
To conserve the exhausted IPv4 address space. CGNAT lets many subscribers share one public address, so the operator does not have to give each customer their own public IP.
Does CGNAT break gaming and P2P apps?
It can hinder them, because the subscriber has no public address of their own and cannot forward ports. Direct connections and self-hosting are then limited.
What is the 100.64.0.0/10 range?
It is an address pool reserved in RFC 6598 for use in carrier networks between the subscriber's router and the CGNAT device, so it does not clash with private addresses in the customer's home network.
Does IPv6 remove the need for CGNAT?
In the target model, yes. IPv6 provides enough addresses for every customer to have their own public space. In practice operators run dual-stack, where IPv6 offloads CGNAT and translation only handles the shrinking IPv4 traffic.